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Abstract 

We study the class of protocol s for weak quantum coin flipping intro- 



duced by Spekkens and Rudolph (quant-ph/0202118). We show that, for 



any protocol in this class, one party can win the coin flip with probability 
at least l/\/2. 



1 Introduction 

Coin flipping is a cryptographic primitive in which two parties (Alice and Bob) 
together generate a random bit so that the value of the random bit cannot be 
controlled by any one party. If both parties are honest, the random bit must be 
with probability 1/2 and 1 with probability 1/2. If one party is honest but 
the other is not, the honest party is still guaranteed that the cheater cannot 
control the outcome. 

There are two variants of this requirement. In strong coin flipping, we require 
that, no matter what a dishonest Alice (dishonest Bob) does, the probability 
of the result being a is at most Pa (at most Pb), for each of the two possible 
outcomes a G {0, 1}. In weak coin flipping, we know in advance that one outcome 
(say, 0) benefits Alice and the other outcome (say, 1) benefits Bob. Therefore, 
we only require that dishonest Alice cannot make result with probability more 
than Pa and dishonest Bob cannot make the result 1 with probability more than 
Pb. 

Coin flipping is possible classically with complexity assumptions such as the 
existence of one-way functions || . In an information-theoretic setting (parties 
with unlimited computational power), in any classical protocol there is a party 
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which can set the outcome to with certainty and 1 with certainty. Thus, 
neither of the two variants is possible classically information-theoretically. 

In the quantum model, strong coin flipping has been studied by || ^, [l], ||, 
0, 0, §. The best protocol [g [Hj can achieve any combination of Pa and Pg 
such that < Pa, < Pg, Pa + Pb = \- In particular, if we want to have the 
same security guarantees for both parties, we can achieve Pa = Pb = f ■ The 
best known lower bound is that any protocol for strong coin flipping must have 
PaPb > 5 0- If we want to have the same security guarantees for both parties, 
this gives Pa = Pb = ■ This is quite close to what is achieved by |pl, |To||. 

Less is known about weak coin flipping. The lower bound of does not 
apply to weak coin flipping. Thus, we might still have a protocol for weak coin 
flipping with Pa = \ + e and Pg = \ + e for an arbitrarily small e > 0. (An 
"exact" protocol with e = is impossible because the impossibility proof for 
exact protocols from Q applies to weak coin flipping. Also, we know that if 
e > is achievable, at least ft (log log -) rounds are needed 0.) 

Weak coin flipping has been studied by p , 11 . The first protocol achieved 



Pa = Pb ~ 0.327.... described a general class of protocols and showed that 
this class achieves any combination of Pa , Pb such that < Pa < 1, < Pb < 1 
and PaPb = \- (The protocol achieving PaPb = \ was also independently 
discovered by the author of this note.) Q conjectured that this is the best 
possible for this class of protocols. In this note, we prove this conjecture. 



2 A class of protocols 

Rudolph and Spekkens (IT) considered the following class of protocols for weak 
coin flipping: 

1. Alice prepares a pair of systems in a state € Ha ® H-B and sends the 
system B to Bob. 

2. Bob performs the POVM measurement {Eq, Ei} on Hb, sends a classical 
bit b with the outcome of the measurement to Alice. 

3. lib = 0, Bob sends the system B back to Alice. If b = 1, Alice sends the 
system A to Bob. The party that receives the system then checks whether 
the joint state of A and B is \4>b) = _M^SMl= by measuring an observ- 

(if>\I0E b \4>) 

able consisting of \4>b) and its orthogonal complement. The possibilities 
are 

(a) b = 0, Alice finds \ipo). Bob wins. 

(b) 6 = 0, Alice does not find |-0o)- Alice has caught Bob cheating. 

(c) 6=1, Bob finds \tpi). Alice wins. 

(d) 6=1, Bob does not find l^i)- Bob has caught Alice cheating. 
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Different choices of Eq and E\ give different protocols. |Tl[] showed how 
to achieve any combination of < Pa < 1, < Pb < 1 such that PaPb = h- 
They also showed that this is the best possible for this protocol using two- 
dimensional systems Ha and Hb and conjectured that this is the best for Ha 
and Hb of arbitrary dimension. Thus, using qubits would be optimal for this 
class of protocols, unlike in the known protocols for strong quantum coin flipping 
[|l Eol where qutrits are needed to achieve the best results. 



3 The lower bound 

We now prove this conjecture. 

Let P A nax (Eo, IV 7 )) and Pg ax (Eo, |i/>)) be the maximum probabilities of win- 
ning for Alice and Bob, for the given choices of Eq and We use the expres- 
sions for P% ax and Pg ax shown by §A$: 

PT X = 2Tr(pE^), Pg ax = 2Tr(^^^) 2 , 

where p is the density matrix of Bob's part of \ip). We will show that the 
product of these expressions is at least \. The first step is to show that it is 
enough to consider the case when the Schmidt decomposition of consists of 
eigenvectors of Eq. 

Lemma 1 For any choice of \ip) and Eq in the protocol of J71|/ . there exists \tp) 
such that Bob's part of Schmidt decomposition of \ip) consists of eigenvectors of 
E and P% ax (E , $)) < P^^o, W)), ^(^o, |$) < PJT^o, W))- 

Proof: Let |<^i), . . ., \(f>k) be the eigenvectors of E Q . Since E\ ~ 1 — E , they 
are also eigenvectors of E\. We write the state \ifi) sent by Alice in round 1 as 

i=i 

Notice that this is not a Schmidt decomposition because \<f>i) are not necessarily 
orthogonal. We consider a protocol in which Alice sends the state 

fc 

i$=$i>ii>i&) 

i=l 

instead of We claim that P™ ax and P™ ax in this protocol are less than 
or equal to p™ ax and P™ ax when Alice sends \ifj). This is shown by mapping 
Alice's and Bob's cheating strategies from the protocol with to the protocol 
with 



3 



Case 1: Alice. The most general strategy of Alice is to prepare a state 

k 

|V/> = £ mWi)\<k)- 

i=l 

Bob's measurement splits the state into two parts \ip' Q ) and Since \4>i) are 

eigenvectors of Eq and E\ , 

k 
i=l 

After Alice sending her part to Bob, Bob tests the state against the state 
\ipi) which would have resulted if Alice had prepared the honest state \ip). Since 
is a superposition of |i)|<fo) and Eq, Ei are diagonal in the basis consisting 
of \4>i), \ipi) is a superposition of |i)|<fo) as well. Therefore, the inner product 
between and \?pi} is maximized if |</^) = \i) for all i and, if Alice sends 

k 

IV"> = I>I<>I&) 

i=l 

instead of this only increases her success probability. To finish the proof, 
notice that sending the state 

k 

i=l 

in the protocol for \ip) achieves the same probability as sending \ip") in the 
protocol for 

Case 2: Bob. An honest Bob's measurement splits \ip) into states |^o) an d 
IV^i). Since Eq and E\ are diagonal in the basis \<f>i), the state |^o) is of the 
form 

l^o) = ^2,a>i\i)\<t>il- 

i 

A dishonest Bob's most general strategy is to transform the state \tp) into a 
state having maximum overlap with IV'o)- Since he cannot access the state 
having maximum overlap is just \tp). Therefore, Bob's best strategy is just to 
leave \rp) unchanged, claim b = and send his part of the state back to Alice. 
The same success probability can be achieved by Bob in the protocol for \ip) by 
a similar strategy (claim b = and send the state back). □ 

Similarly to O], let p be the density matrix of Bob's side of \xjj). We write 
density matrices p and Eq in the basis consisting of \ipi). Both matrices are 



4 



diagonal in this basis. Let ai be the elements on the diagonal of p and bi be the 
elements on the diagonal of Eq. Then, 



k 



Pr * =2 Tr(pE 2 ) = 2'£a i bt 



»=i 

2 



prnax = 2T r(^p~E^) 2 = 2(^a 4V ^) 2 

1=1 

and we have the extra constraint that Tr(pEo) = J2i a i^i = \ (because the 
outcome of an honest coin flip is with probability 1/2). 

By Holder's inequality, we have ||x||3||y|| 3 > (x\y) and ll^c II 3 II 3/11 a > ( x \y) 3 

2 2 

for any vectors x, y. Applying this inequality to x — (aj^ 3 6? )f =1 and y — 
, 2/3,1/3^ 

K V )i=i S lves us 



i=l \ ?'— 1 / \ ?' — 1 



i\ 3 1 
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4 Conclusion 

We have shown that any choice of parameters in the protocol of jy] gives 
pmaxpmax -> i_ Curiously, this is the same as the lower bound of || for 
arbitrary protocols for strong coin flipping. However, there does not seem to 
be any direct connection between the two results. It remains open whether a 
different protocol (not in the class described above) for weak coin flipping could 
achieve a better security. 

Another interesting question about coin flipping protocols is "cheat-sensitivity' 
studied by pi ||, ^l). A protocol for coin flipping or other cryptographic tasks 
is cheat-sensitive if a dishonest party cannot increase the probability of one 
outcome without being detected with some probability. Many quantum pro- 
tocols display some cheat-sensitivity but it remains to be seen what degree of 
cheat-sensitivity can be achieved. 

Acknowledgment. Thanks to Terry Rudolph for useful comments. 
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